RFI_Sources Sought_ FPKI Technical and Operations Support.pdf

GSA FPKI Technical and Operations Support RFI/Sources Sought

General Services Administration (GSA) Federal Public Key Infrastructure Management Authority (FPKIMA) Technical and Operations Support

Request for Information (RFI) and

Sources Sought

August 2024

RFI & SS #: 47QTCB24N0005

TABLE OF CONTENTS

SECTION PAGE

1.0 DISCLAIMER 3

2.0 FEDERAL PUBLIC KEY INFRASTRUCTURE (FPKI) 3

2.1 Overview 3

2.2 Scope 4

3.0 INSTRUCTIONS TO RESPONDENTS 4

4.0 INFORMATION REQUESTED FROM RESPONDENTS 5

4.1 Experience with PKI support 5

4.2 Experience with Publicly Trusted CAs 5

4.3 Experience with Security Management 5

4.4 Emerging and New Technologies 5

REQUEST FOR INFORMATION (RFI)/SOURCES SOUGHT

1.0 DISCLAIMER

This Request for Information (RFI) does NOT constitute a Request for Proposal and is not to be construed as a commitment, implied or otherwise, by the Government that a procurement action will be issued.

No telephone inquiries will be accepted and requests for solicitation packages will not be honored, as no solicitation is intended at this time. Response to this notice is not a request to be added to a bidders list or to receive a copy of a solicitation.

No entitlement to payment of direct or indirect costs or charges by the Government will arise as a result of the submission of the requested information. No reimbursement will be made for any costs associated with providing information in response to this announcement and any follow up information requests.

Responses to this RFI may be considered in the future determination of an appropriate acquisition strategy for the program. The Government may not respond to any specific questions or comments submitted in response to this RFI or information provided as a result of this request.

Any information submitted by respondents as a result of this notice is strictly voluntary.

2.0 FEDERAL PUBLIC KEY INFRASTRUCTURE (FPKI)

2.1 Overview

The Federal Public Key Infrastructure (FPKI) was created out of the E-Government Act of 2002 which directed the General Services Administration to establish and operate the Federal Bridge Certification Authority (FBCA). From this initial program, the Federal PKI has grown into a diverse PKI ecosystem of hundreds of Certificate Authorities (CAs) for federal and state government agencies as well as foreign and US commercial participating PKIs.

The centralized operation and support of the FPKI provides for the tracking, participation, dissemination, and implementation of PKI for the Federal Government to be rapidly and cost-effectively compliant with changes and/or new requirements or orders from several different Federal Government and other policy organizations.

These include the Office of Management and Budget (OMB), the FPKI Policy Authority (FPKIPA), National Institute of Standards and Technology (NIST), the Federal CIO Council, and other similar organizations. Emerging requirements are driven from numerous factors including National Policy, stakeholder needs, technological advancements, or current or future security risks and issues.

The FPKI Trust Infrastructure is the backbone of the FPKI hierarchy. It currently consists of two central certification authorities operated by the FPKI Management Authority (FPKIMA) referred to as FPKI Trust Infrastructure CAs. Any CA in the FPKI can be referred to as a “FPKI CA,” but only those operated and maintained by the FPKIMA are FPKI Trust Infrastructure CAs in accordance with the X.509 Certificate Policy for the U.S. FPKI Common Policy Framework and the X.509 Certificate Policy for the Federal Bridge Certification Authority (FBCA). The two CAs are:

● The Federal Common Policy CA (FCPCA): The trust anchor for the federal Government

● The Federal Bridge CA (FBCA): The PKI Bridge that enables interoperability between different federal PKIs and between Federal and external PKIs for state, local, or foreign governments as well as commercial entities

2.2 Scope

The overall scope of FPKI support requirements includes:

● Supply of data centers and Internet communications infrastructure meeting DoD Top Secret facility requirements to host Government Furnished Equipment (GFE) provided systems

● Supply of proactive and disciplined personnel that are knowledgeable and experienced in all relevant technology and operations areas including PKI, networking, virtualization, network management, hardware, security and information assurance

● Supply of a proactive, disciplined and experienced Program Manager that understands and addresses the strategic needs of the program, drives organizational effectiveness and change management, and fosters leadership and collaboration across the team

● Operations, maintenance and management of PKI capabilities, network and cloud infrastructures including design, integration, and testing of new technologies for PKI, networking, network management, hardware, software, security and information assurance

● Solid design, implementation and operational support for security management and cyber protection

● Analysis and implementation of existing and emerging policies pertinent to PKI, technical analysis, stakeholder and community support

3.0 INSTRUCTIONS TO RESPONDENTS

Respondents to this RFI should be aware that the Government is seeking respondents who can demonstrate their past experience and overall capabilities to meet the scope and requirements of the FPKI support role for the GSA and the Federal Government.

GSA is also soliciting market information regarding emerging technologies pertinent to finalizing acquisition planning. The responses to this RFI will be captured as market research and may contribute to refinement of technical requirements and update of the acquisition strategy.

All submissions shall become Government property and will not be returned. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. The information provided in this RFI is subject to change and is not binding on the Government.

Responses are limited to 10 pages. The Government will not read or assess material provided in excess of this limit. To ensure readability by the Government, responses must have a minimum font size of 10, and pages must have a 1-inch border at minimum. Respondents are also requested not to provide generic corporate marketing material as this will be discarded.

4.0 INFORMATION REQUESTED FROM RESPONDENTS

Responses to Section 4.0 are meant to supplement the vendor’s responses to the attached questions.

4.1 Experience with PKI support

Respondents are requested to summarize past experience and capabilities with designing, implementing, operating, managing and securing CAs. Include experience with developing and maintaining a certificate policy (CP) and certificate practice statement (CPS), hardware security module (HSM) integrations, generating certificate revocation lists (CRLs), and certificate management.

4.2 Capabilities with Federal PKI Support

Respondents are requested to summarize their capabilities to move from PKI to Federal PKI. The Federal PKI follows these policies: X.509 Certificate Policy for the U.S. FPKI Common Policy Framework and the X.509 Certificate Policy for the Federal Bridge Certification Authority (FBCA).

4.3 Experience with Publicly Trusted CAs

Respondents are requested to summarize past experience and capabilities with designing, implementing, operating, managing and securing publicly trusted CAs that meet CA/Browser Forum compliance requirements. Include experience with WebTrust Audits.

4.4 Experience with Security Management

Respondents are requested to summarize past experience and capabilities with security best practices, processes, and procedures. Include experience in maintaining compliance with National Institute of Standards and Technology (NIST) security standards to include NIST 800-53 and/or High Value Assets (HVAs).

4.5 Emerging and New Technologies

Respondents are requested to summarize emerging technologies or innovative ideas the Government should be considering when developing its PKI support requirements.